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(54) Monitoring of computer usage 

(57) A utility operates on a networked PC and peri- 
odically executes a callback process to capture data to 
create discrete events. The callback process is period- 
ically started, and it writes an event f either a frame pe- 
riod of 15 rnins. has expired or the used application has 
changed, whichever is earlier. A protection program ex- 
ecutes in parallel with a main program, both checking 
for a mutex of the other and re-starting the other if the 
mutex ceases to exist. Event data is automatically clas- 
sified according to productivity classifications associat- 
ed with applications. 
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Description 

INTRODUCTION 
Field of the Invention 

[0001 ] The invention relates to monitoring of usage of 
computers such as networked PCs. 

Prior Art Discussion 

[0002] It is known to provide programs to perform 
such monitoring. For example, United States Patent 
Specification No. 5675510 (PC Meter L.P.) describes a 
system in which window titles are used to determine us- 
age and to make entries to a log file. However, there is 
still a need for a system to capture more information for 
use in generation of comprehensive reports such as re- 
ports for corporate organisations having many employ- 
ees using computers. There is also a need for improved 
security in operation of monitoring programs to improve 
integrity of reported data. 

SUMMARY OF THE INVENTION 

[0003] According to the invention there is provided a 
computer usage monitoring utility comprising means for 
operating as a background application transparently to 
a user to capture usage data indicating usage of the 
computer, wherein the utility comprises means for auto- 
matically determining a productivity classification for 
each used application identified in the usage data. 
[0004] In one embodiment, the utility comprises 
means for recording an event for each application used 
by a user and for applying a productivity classification 
for each event. 

[0005] In one embodiment, the utility accesses a clas- 
sification table in which a productivity classification is 
allocated to application groups, to applications, and to 
window text keywords. 

[0006] In one embodiment, the utility comprises 
means for attempting to classify productivity in se- 
quence according to application group, application, and 
keywords. 

[0007] In one embodiment, the utility comprises 
means for checking for an active window at periodic call- 
back intervals, and for marking an idle indicator if user 
activity is below a threshold. 

[0008] In one embodiment, the utility comprises 
means for generating an event record at a callback in- 
terval when either a frame time period expires or when 
an active application changes, whichever is earlier. 
[0009] In one embodiment, the utility comprises 
means for determining usage data according to a cap- 
tured number of actions of user input devices such as a 
keyboard and a mouse. 

[0010] In one embodiment, the utility comprises 
means for incrementing an idle count at periodic inter- 



vals if an input device is inactive and for marking a win- 
dow as idle when the count reaches a threshold. 
[0011] In another embodiment, the utility comprises 
means for maintaining a temporary list of applications 

5 associated with windows previously identified, for re- 
trieving an application name for a window if the window 
is present in the list, and for interrogating the operating 
system to determine the application name if the window 
is not in the list. 

10 [0012] In one embodiment, the utility comprises 
means for searching in an operating system for an 
opened process with a name indicating that it is an ex- 
ecutable associated with a window. 
[0013] In one embodiment, the utility comprises 

15 means for capturing an active URL if the active applica- 
tion is a browser. 

[0014] In one embodiment, the utility comprises an 
authorised stop program for closing the utility for pur- 
poses such as upgrade. 
20 [0015] In one embodiment, the stop program compris- 
es means for creating a stop mutex, and the utility com- 
prises means for closing down in an orderly manner if 
the mutex is opened. 

[0016] In one embodiment, the utility comprises a lis- 
25 tener thread for listening for a mutex at periodic inter- 
vals. 

[0017] In one embodiment, the utility comprises a pro- 
tection program comprising means for executing in par- 
allel to a main program implementing monitoring func- 
30 tions, both the main program and the protection program 
comprising means for determining if the other has 
stopped executing, and for re-starting it if it has stopped 
executing. 

[0018] In a further embodiment, both the main pro- 
35 gram and the protection program open a mutex and 
comprise means for detecting existence of the mutex of 
the other to determine if the other is executing. 
[0019] In one embodiment, the utility comprises a sec- 
ond protection program comprising means for re-acti- 
40 vating the main program or the first protection program 
if either stops operating and for terminating itself when 
it has finished execution. 

[0020] In one embodiment, the main program com- 
prises means for writing an alert to a log file if a protec- 
ts tion program is terminated. 

[0021] In one embodiment, the utility comprises a live 
transfer mechanism for automatic transfer of event 
records to a server in real time. 

[0022] In one embodiment, the utility further compris- 
so es a triggered event mechanism comprising means for 
triggering an alert message if alert usage conditions are 
met. 

[0023] In one embodiment, an alert condition is set ac- 
cording to a user profile. 
55 [0024] According to another embodiment, the inven- 
tion provides a computer usage monitoring utility com- 
prising means for operating as a background application 
transparently to a user to capture usage data indicating 



2 



BNSDOCID: <EP 1096382A2_I_> 



3 



EP 1 096 382 A2 



4 



usage of the computer, wherein: 

the utility comprises means for recording usage da- 
ta in discrete events, in which there is an event at 
expiry of a periodic frame interval or when a used 
application changes, whichever is earlier, and the 
utility comprises means for activating a callback 
process at periodic intervals to check for either of 
said two conditions exist, and 

the utility comprises means for automatically deter- 
mining a productivity classification for each event. 

DETAILED DESCRIPTION OF THE INVENTION . 

Brief Description of the Drawings 

[0025] The invention will be more clearly understood 
from the following description of some embodiments 
thereof, given by way of example only with reference to 
the accompanying drawings in which:- 

Fig. 1 is a flow diagram illustrating operation of an 
initialisation routine for a data collection utility of the 
invention; 

Figs. 2 to 8 are flow diagrams illustrating operation 
of the utility; 

Fig. 9 is a diagram illustrating protection of the util- 
ity; and 

Fig. 10 is a diagram illustrating capture of produc- 
tivity information. 

Description of the Embodiments 

[0026] Referring to Fig. 1 an initialisation process 1 
for a data collection utility of the invention is illustrated. 
The utility operates as a background process in a user's 
PC in a transparent manner with minimal effect on ap- 
plications running on the computer. 
[0027] An internal hidden window is created in step 2 
and Dynamic Linked Libraries (DLLs) are loaded in step 
3 for operation of the utility. In step 4, the utility reads 
configuration settings from the system registry and in 
step 5 it sets up keyboard and mouse hooks. A "snap- 
shot" timer is set up in memory in step 6. A protection 
thread is started in step 7. This is an independent thread 
which checks every second for the existence of a stop 
mutex and for the existence of a protection mutex, de- 
scribed in detail below. Any outstanding log files are 
transferred in step 8, and a start-up atert to indicate the 
time of starting is recorded in step 9. 
[0028] A main event process 20 is illustrated in Fig. 2, 
and as indicated by a decision step 21 the three possible 
events are snap shot timer callback 22, operating sys- 
tem shutdown 23, and end task request 30. A snap-shot 



timer callback process 22 is activated for the main op- 
eration of the utility.. This is described in detail below. 
The main event process 20 also includes an operating 
system (Windows™ in this embodiment) shut-down 
5 process 23. This comprises recording an alert with the 
shut-down time in step 24, and in a "write out last entry" 
process 64 it writes out an entry to save records in mem- 
ory to a disk file. Operating system shut-down also re- 
sults in the utility attempting to transfer any files to a 
10 server in step 50. The protection thread is stopped in 
step 27 and the utility exits in step 28. The end task re- 
quest process 30 arises upon an attempt to stop oper- 
ation of the utility. An alert is recorded in step 31 , mem- 
ory records are saved to file in step 64, and a file transfer 
15 attempt is made in step 50. According to a decision step 
34, if a stop flag is set (indicating authorised closing of 
the utility) the protection thread is stopped in step 35. If 
not, the utility exits in step 36. 

[0029] A primary operation of the utility is the callback 
process 22, described in detail now with reference to 
Fig. 3. This process is started at periodic intervals which 
are configurable. A typical interval is 5 sees. In step 40 
the protection thread checks if the stop mutex has been 
set by the closing program of the utility. The stop mutex 
is used to allow an authorised user or process to termi- 
nate the utility for upgrading or other authorised reason. 
If this is set, the utility records an alert to the effect that 
is has closed and the alert includes details of the user 
or process which used the stop mutex. The log files are 
transferred in step 50 and the utility is closed in step 53. 
[0030] The protection thread also checks every sec- 
ond for the protection mutex, as described in detail be- 
low. 

[0031] If the stop mutex has not been set, in step 41 
the utility gets the active window, and in step 42 it gets 
the key-hit and mouse event counts using the hooks 
which were set up at initialisation. This is achieved by 
using the function "SetWindowsHookEx" in Windows™ 
to hook all keyboard and mouse activity. A counter is 
incremented with every keystroke and every mouse ac- 
tion. 

[0032] As indicated by a decision step 43, if there has 
not been any keyboard or mouse activity an idle count 
is incremented in step 44 and is then checked in step 
45 against a user setting. If the count exceeds the user 
setting the window is marked as idle in step 47. If there 
has been mouse or keyboard activity the idle count is 
reset in step 46. 

[0033] An "active window" process 48 is then execut- 
ed. As indicated by the decision step 49 when the next 
file transfer time is reached the "file transfer" process 50 
is implemented. Thus, the utility effectively records both 
user activity in relation to applications, and also when 
the system is idle in the form of "idle events". 
[0034] Referring now to Fig. 4 the "active window" 
process 48 is described. This process ensures that 
there is an event either (a) when a frame time of 1 5 min- 
utes expires, or (b) when an application is changed, 
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whichever is earlier. Thus, there is an event at least eve- 
ry frame period and this allows event database reporting 
programs to use timelines synchronised with the 
frames. 

[0035] In step 60 the utility captures the window title 
text to provide an indication of what the user is doing. 
In step 61 it checks if the title is a general shell title such 
as "Program Manager", which can be ignored. The cur- 
rent record in memory is saved to disk at the end of every 
frame. The new record which is created has the same 
information as the previous record but a duration field 
set to zero. The utility monitors real time for expiration 
of the current frame period as indicated in step 62. If it 
has expired, in step 63 the utility determines if the cur- 
rent entry occurred in the previous or the new frame and 
it executes the "write out last entry" process 64 followed 
by the "create new entry" process 65. The utility deter- 
mines if the current window is the same as the last win- 
dow in step 66, and if so it returns to the call-back routine 
22 in step 70.. If not, in step 67 it calculates the duration 
of the last entry using the following counters: 

a foreground counter of the time the window has 
been receiving keyboard or mouse user inputs, 



a key-hit counter, and 

a mouse event counter. 

[0036] The "write out last entry" process 64 and the 
"create new entry" process 65 are then implemented. In 
this way there is a last entry write-out at either a frame 
time-out or a new application being used, whichever is 
earlier. 

[0037] Referring to Fig. 5, the "write out last entry" 
process 64 is now described. As indicated by step 80 
the utility determines if a file transfer is in progress, and 
if so it adds the entry to a temporary list in step 89. If 
not, in step 81 it checks if the temporary list is empty. If 
not empty, in step 82 it gets the entry at the head of the 
list and if empty it uses the current entry. In step 84, it 
checks if a URL flag has been set, indicating that a 
browser is the active application. If so, it appends the 
URL to the window text in memory. 
[0038] The entry is encrypted in step 86 and the entry 
is written to the log file in step 87. The encrypted data 
is binary with checksums. As indicated by the decision 
step 88 steps 81 to 87 are repeated until all the entries 
are written out. 

[0039] The process 65 for creating a new entry is il- 
lustrated in Fig. 6. Memory is allocated in step 100 and 
variables are initialised in step 101. The variables are 
username, computer name, current time, and window 
title. A window list is maintained and if the current win- 
dow is already in the list (step 1 02) the application name 
is retrieved from the window list in step 1 1 0. This list min- 
imises the number of searches that have to be conduct- 
ed. Thus, placing of a window in the background or min- 



imising it will not result in a new process tree search 
when that window becomes active again. If not in the 
list, in step 103 the utility gets the ID of the application. 
If the OS is NT™ (Step 104) the utility simple finds the 
5 performance statistics for the ID in step 1 05. If not NT™ , 
the utility scans through the applications using Toolhelp 
routines in step 106. This involves taking a snapshot of 
all running processes and scanning through each one 
that has a ".exe", a ".scr" extension, or any other exe- 
io cutable file name extensions for the one with a process 
ID that matches the process ID associated with the cur- 
rent window handle. As indicated by the steps 107 and 
109 the value "UNKNOWN" is written if the application 
details are not found, and they are written in step 108 if 
1 $ they are found. The utility determines if the application 
is an Internet browser in step 111 , and if so it gets the 
URL in step 12 and sets a URL flag in step 113. Flow 
returns to the main process in step 114. Each record 
(entry) includes the computer name, the username, the 
20 current time (start time of event), frame start time, time 
of window snap shot, additional information such as win- 
dow text, application name, event duration, number of 
key strokes, the number of mouse events, and, if appli- 
cable, the URL. 
25 [0040] Referring to Fig. 7 the "transfer log file" process 
50 is described. In step 120 the local log file is closed 
and it is copied to the remote server in step 121 accord- 
ing to the configured directory path. The log file is re- 
opened in step 125 if the copy is not successful as indi- 
30 cated by step 122. If successful, the log file is deleted 
in step 123 and a new log file is opened in step 124.. 
Return to the main program is indicated by step 126. 
[0041 ] Referring to Fig. 8, the utility has a background 
protection thread which checks for the stop mutex and 
35 the protection mutex. As indicated by the decision step 
1 31 , if the stop mutex exists a stop flag is set in step 1 36 
and the thread is stopped in an orderly manner in step 
137 by the stop program of the utility. The thread also 
checks (step 132) for the protection mutex. If this does 
not exist an alert is created in step 1 33 and a protection 
program is started in step 134. The utility then "sleeps" 
for 1 second before return to step 131, i.e. the thread 
checks for each mutex every second. 
[0042] in more detail, the stop mutex is opened by a 
45 stop program of the utility which allows authorised and 
orderly closing of the utility for purposes such as up- 
grade. This program is password-protected. 
[0043] The protection mutex is opened by a protection 
program of the utility and should always exist. The main 
so program of the utility ("DCU App") and the protection pro- 
gram ("DCUProt") each have a thread checking the pro- 
tection mutex of the other. The protection program is 
open, but not performing any processing activity. If the 
mutex of the main program is absent, it automatically 
55 re-starts the main program. If the mutex of the protection 
program is absent, the main program automatically re- 
starts the protection program. There is thus parallel pro- 
tection because absence of either mutex is an indication 
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of an unauthorised attempt to close the utility. The pro- 
tection program has either standard protection or ex- 
tended protection functions, as set out below. 

Standard Protection (Fig. 9) 

[0044] Should a user attempt to stop the utility using 
the task manager the other program running in parallel 
detects that the mutex is missing and restarts the rele- 
vant program. Should the user attempt to terminate the 
second program, then the original utility detects that it 
has been removed, and restarts this second program. 
[0045] Therefore, the only way for a user to terminate 
the utility is to be able to terminate both programs at the 
same time, which is not possible using Windows 9x op- 
erating systems. Additionally, The second utility has a 
generic filename so as to be inconspicuous within the 
task manager. 

Extended Protection. 

[0046] When a utility starts a second utility, the Micro- 
soft Windows™ operating system sets a 'process tree' 
from one application to the other. In Windows NT / 
2000™ operating systems, a user can specify to termi- 
nate a process and its process tree. This allows illegal 
termination of the utility by process tree termination on 
Windows NT or 2000™ operating systems. With extend- 
ed protection, each utility calls a third , transitory appli- 
cation which executes the terminated utility. This third 
utility terminates as soon as it has finished its execution, 
therefore releasing the process tree from the two paral- 
lel applications. Extended protection makes it impossi- 
ble to terminate illegally using Microsoft 9x, NT™ or 
Windows 2000™ operating systems. Fig. 9 illustrates 
the protection mechanisms diagramatically, in which the 
utility is referred to as a Data Collection Utility Applica- 
tion (DCUApp). 

Alert Log Mechanism. 

[0047] As well as storing application data to the log 
files the utility stores alerts which include details such 
as USER LOGIN and SHUTDOWN. Importantly, alerts 
are used to log attempts to stop the utility. 
[0048] Since the application is started by a registry 
setting the user may attempt to change this.. This will 
mean that no records will be recorded for that user, 
hence alerting the manager to a problem. Additionally 
since the product is a data monitor any attempt to 
tamper with the registry settings will be seen in the log- 
files providing that the snapshot interval is not increased 
above a reasonable level. 

[0049] The utility includes a data upload program 
which runs either as a Windows NT™ service or as a 
stand alone program. It must be located on the computer 
which has the log database. After a user-configurable 
time-frame, the log files within the central server direc- 



tory are interpreted by the data upload utility. The data 
upload program performs the following: 

NT Service Uploading, 

5 

Standard Executable Uploading, 
TCP/IP Uploading, 

io Log entry error detection. Each entry within a log 
file is marked as uploaded if it is successfully added 
to the central database store. If no errors occur dur- 
ing the uploading of a log file, the log file is deleted 
once ail entries have been uploaded. If errors occur 

15 on entering an entry into the database, this entry is 
written to a separate error file and the next log entry 
is added to the database, and 

Log file deletion. Once all records of a log file are 
20 successfully imported into the database, the log file 
is deleted. 

[0050] During upload and generation of new log en- 
tries within the database, a number of further classifica- 
25 tions are made. 

Group Identification and Allocation. 

[0051] Each entry of the log file contains a user, corn- 
30 puter, application and window title which needs to be 
entered into the server database. If a log file entry con- 
tains a new user, computer, or application, a corre- 
sponding entry is placed within the appropriate area of 
the database. If the log file contains existing information, 
35 only the reference to the existing information is required 
to be stored within the database. This allows for a highly 
optimised database system. 

Productivity Allocation. 

40 

[0052] Each logged entry within the database must be 
assigned a productivity rating when placed within the 
database. The assignment of a productivity rating is de- 
pendent on the window text contained in the log, the ap- 
^5 plication of the log entry, or the group to which the ap- 
plication has been assigned. The productivity relation- 
ship is illustrated in Fig. 10. 

[0053] If the log entry contains an application which 
is in a group that is marked as productive or unproduc- 

50 tive, then the productivity score for this group is as- 
signed to the entry for this log item. If the application 
group's productivity is marked as dependent on appli- 
cation then the productivity of the log item is set from 
the productivity of the application. If the productivity of 

55 the application is set to unknown, then window text of 
the log item is compared with a set of known keywords. 
Each keyword has a specified productivity rating. If no 
keywords match, then the productivity for this log item 
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is set to unknown entry 
Background Task Logging 

[0054] The utility can be used to monitor all back- 
ground windows on the user's PC. This is achieved us- 
ing the EnumWindows™ Function to scan through all 
desktop windows, limiting to only visible windows using 
the IsWindowVisible Function and storing the records to 
an internal linked list. Background window information 
may be useful in situations such as where certain users 
may try to thwart the utility by keeping a productive ap- 
plication active as a small window in the foreground 
while reading a non-productive item as a larger inactive 
window in the background. 

[0055] A live transfer mechanism may be used in- 
stead of the log file mechanism, in which the utility trans- 
mits records over a TCPIP link rather than writing to a 
log file. In the event that the link is unavailable records 
are stored to the log file and transferred when the link 
is re-established. 

[0056] The utility also includes a triggered event 
mechanism to automatically execute an event based on 
an activity or sequence of activities performed by a user 
such as non-productive activity exceeding a predefined 
period in a particular day or alerting a user if they spend 
excessive time at a particular task. The utility also iden- 
tifies standard profiles for users and triggers an alert 
when a userfalls outside a predefined tolerance as iden- 
tified by a standard profile. 

[0057] It will be appreciated that the invention pro- 
vides for capture of very comprehensive information. 
This information is in discrete event records, which are 
simple to manipulate downstream for generation of re- 
ports. The frequency of event records allows time-based 
reports to be generated in a simple manner. For exam- 
ple productivity versus time can be easily plotted from 
the database. Because data is captured at the periodic 
callback process intervals there is very little impact on 
operation of the computer, as opposed to the prior ap- 
proach of trapping all commands. 
[0058] The invention is not limited to the embodiments 
described, but may be varied in construction and detail. 



Claims 

1. A computer usage monitoring utility comprising 
means for operating as a background application 
transparently to a user to capture usage data indi- 
cating usage of the computer, wherein the utility 
comprises means for automatically determining a 
productivity classification for each used application 
identified in the usage data. 

2. A computer usage monitoring utility as claimed in 
claim 1 , wherein the utility comprises means for re- 
cording an event for each application used by a user 



and for applying a productivity classification for 
each event. 

3. A computer usage monitoring utility as claimed in 
claim 2, wherein the utility accesses a classification 
table in which a productivity classification is allocat- 
ed to application groups, to applications, and to win- 
dow text keywords. 

10 4. A computer usage monitoring utility as claimed in 
claim 3, wherein the utility comprises means for at- 
tempting to classify productivity in sequence ac- 
cording to application group, application, and key- 
words. 

15 

5. A computer usage monitoring utility as claimed in 
any preceding claim, wherein the utility comprises 
means for checking for an active window at periodic 
callback intervals, and for marking an idle indicator 

2 ° if user activity is below a threshold. 

6. A computer usage monitoring utility as claimed in 
claim 5, wherein the utility comprises means for 
generating an event record at a callback interval 

?5 when either a frame time period expires or when an 
active application changes, whichever is earlier. 

7. A computer usage monitoring utility as claimed in 
claims 5 or 6, wherein the utility comprises means 

w for determining usage data according to a captured 
number of actions of user input devices such as a 
keyboard and a mouse. 

8. A computer usage monitoring utility as claimed in 
$ any of claims 5 to 7, wherein the utility comprises 

means for incrementing an idle count at periodic in- 
tervals if an input device is inactive and for marking 
a window as idle when the count reaches a thresh- 
old. 

40 

9. A computer usage monitoring utility as claimed in 
any of claims 5 to 8, wherein the utility comprises 
means for maintaining a temporary list of applica- 
tions associated with windows previously identified, 

is for retrieving an application name for a window if 
the window is present in the list, and for interrogat- 
ing the operating system to determine the applica- 
tion name if the window is not in the list. 

10. A computer usage monitoring utility as claimed in 
claim 9, wherein the utility comprises means for 
searching in an operating system for an opened 
process with a name indicating that it is an execut- 
able associated with a window. 

55 

11. A computer usage monitoring utility as claimed in 
any preceding claim, wherein the utility comprises 
means for capturing an active URL if the active ap- 
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plication is a browser. 

12. A computer usage monitoring utility as claimed in 
any preceding claim, wherein the utility comprises 
an authorised stop program for closing the utility for 
purposes such as upgrade. 

13. A computer usage monitoring utility as claimed in 
claim 12, wherein the stop program comprises 
means for creating a stop mutex, an the utility com- 
prises means for closing down in an orderly manner 
if the mutex is opened. 

14. A computer usage monitoring utility as claimed in 
claims 12 or 13, wherein the utility comprises a lis- 
tener thread for listening for a mutex at periodic in- 
tervals. 

15. A computer usage monitoring utility as claimed in 
any preceding claim, wherejn the utility comprises 
a protection program comprising means for execut- 
ing in parallel to a main program implementing mon- 
itoring functions, both the main program and the 
protection program comprising means for determin- 
ing if the other has stopped executing, and for re- 
starting it if it has stopped executing. 

16. A computer usage monitoring utility as claimed in 
claim 15, wherein both the main program and the 
protection program open a mutex and comprise 
means for detecting existence of the mutex of the 
other to determine if the other is executing. 

17. A computer usage monitoring utility as claimed in 
claims 1 5 or 1 6, wherein the utility comprises a sec- 
ond protection program comprising means for re- 
activating the main program or the first protection 
program if either stops operating and for terminating 
itself when it has finished execution. 

18. A computer usage monitoring utility as claimed in 
any of claims 15 to 17, wherein the main program 
comprises means for writing an alert to a log file if 
a protection program is terminated. 

19. A computer usage monitoring utility as claimed in 
any preceding claim, wherein the utility comprises 
a live transfer mechanism for automatic transfer of 
event records to a server in real time. 

20. A computer usage monitoring utility as claimed in 
claim 19, wherein the utility further comprises a trig- 
gered event mechanism comprising means for trig- 
gering an alert message if alert usage conditions 
are met. 

21. A computer usage monitoring utility as claimed in 
claim 20. wherein an alert condition is set according 



to a user profile. 

22. A computer usage monitoring utility comprising 
means for operating as a background application 

5 transparently to a user to capture usage data indi- 
cating usage of the computer, wherein: 

the utility comprises means for recording usage 
data in discrete events, in which there is an 

10 event at expiry of a periodic frame interval or 

when a used application changes, whichever is 
earlier, and the utility comprises means for ac- 
tivating a callback process at periodic intervals 
to check for either of said two conditions exist, 

is and 

the utility comprises means for automatically 
determining a productivity classification for 
each event. 

20 

23. A computer program product comprising software 
code portions for providing a utility as claimed in any 
preceding claim when executing on a digital com- 
puter. 



1098382A2 I > 



EP 1 096 382 A2 



(L 

Create Internal Hidden Window 



Load DLLs 



Read Configuration Settings 



Setup Keyboard and Mouse Hooks 



r 



Setup Timer 



Start Protection Thread 



r 



8 



Transfer Log Files 



r 



Record Startup Alert 



rig 



EP 1 096 382 A2 




20 



Snap Timer Callback 



Windows Shutdown 
End Task Request -i 



30 



31 



64 



60- 



Record Alert 



I 





Yes c 




r 


Stop Protection 


Thread 





Write Out Entry 






r 




Transfer Files 




1 


t 




23 



Record Alert 



Write Out Entry 




f 


Transfer Files 


> 


r 


Stop Protection 
Thread 


1 


f 



24 



64 



50 



27 



( j* 



28 



Fig. 2 



BNSDOCID: <EP 1096382A2_L> 



BP 1 096 382 A2 




T 



Get Keyhit count 
and Mouse Event 
count 



42 



43 



51 



Record Afen 



Keyhit count 
or Mouse Event 
Count > 0 

? 

"Yes 



No 



Increment Idle 
Count 



Transfer Log Files 





10 



EP 1 096 382 A2 



48 



i. 



Get Window Title „ — ' 60 
Tcxl 




Yes 




Yes 



No 



Calculate Duration of 
entry from entry start 
time and frame end time 



Write out last entry 



63 



64 



Create new entry 



65 




Create new Entry 



65 



C 



-70 

Return J F ig . 4 



11 



1096382A2_I_> 



EP 1 096 382 A2 




82 



86 



87 



Fig. 5 



Get Entry at Head 
of List 



Encrypt Entry 



Write Entry to Log 
File 



Use Current Entry 



83 




Yes 



85 



Copy URL into 
Window Text 



89 



Add entry to 
temporary list 




c 



Return 



5 



90 



12 



BNSDOCID: <EP. 



,1096382A2_I_> 



EP 1 096 382 A2 



65 



Allocate memory and 
set up linked list pointers 




No 



Get Process ID of Process 
that created this window 



103 




no 



Use application name 
from window list 



105 



Find Performance 
statistics for Process ID 






106 


> 






Scan Through processes 




using loolhelp routines 





Store APP Name 



108 



/ 



1 


< / 


Store "UNKNOWN" in 
AppNamo 



109 



Fig. 6 




13 



BNSDOCID: <EP 1096382A2_I_> 



EP 1 096 382 A2 



Close local Loq File 




r 



Copy filo to romoto 
server 



50 



120 



121 




Open Now Log File 



124 



C 



Return 



126 



Fig. 7 



14 



BNSOOCID: <EP 1096382A2_I_> 



EP 1 096 382 A2 




, < 137 

Q Exit Thread ^ 



Fig. 8 



EP 1 096 382 A2 



140 



DCU App 



mspvdx (DCU Prot) 



DCU App 



DCU Protect 



mspvdx (DCU Prot) 



Standard Protection 



Extended Protection 



Fig. 9 



BNSDOCID: <EP 1096382A2_I_> 



16 



EP 1 096 382 A2 



150 



Application 
Group 



App Group Table 



Productivity Not Set 



Productivity Set 



Application 



App List Table 



Productivity Not Set 



Productivity Set 



Window Text 



Keyword List 
Table 



Productivity Not Set 
f 



Productivity 
Set 



Win Text List 
Table 



Fig. 10 



BNSDOCID: <EP 1096382A2J_> 



17 



